From d47683d616d2e9dabd5c0d10f65891f14db1a680 Mon Sep 17 00:00:00 2001 From: ShaneK Date: Wed, 19 Aug 2026 13:43:07 -0700 Subject: [PATCH] chore(cd): clear the placeholder npm token so trusted publishing works The publish step reached the registry, signed provenance, and then failed with E404 on the PUT. That E404 is npm masking an authorization failure. `setup-node` exports NODE_AUTH_TOKEN as the literal placeholder XXXXX-XXXXX-XXXXX-XXXXX when no token input is given, and the .npmrc it writes points `_authToken` at that variable. npm therefore sent the placeholder as a real credential and never attempted the OIDC exchange, which is why the log has no trusted-publishing activity at all. Reproduced locally against the same .npmrc shape: NODE_AUTH_TOKEN=XXXXX-XXXXX-XXXXX-XXXXX -> E401 Unauthorized NODE_AUTH_TOKEN='' -> ENEEDAUTH, no credential configured The second state is what lets npm fall back to trusted publishing, so the publish step now clears the variable. This requires a trusted publisher to be configured on npmjs.com for both @ionic/angular-toolkit and @ionic/cordova-builders. Without that, the publish fails on auth regardless of this change. --- .github/workflows/cd.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 9d4d25f..488acba 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -47,7 +47,15 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # `lerna publish` uploads via libnpmpublish@4, which supports neither provenance nor # OIDC trusted publishing, so the upload goes through the npm CLI instead. + # + # NODE_AUTH_TOKEN is cleared on purpose. `setup-node` exports the placeholder + # `XXXXX-XXXXX-XXXXX-XXXXX` when given no token, and the .npmrc it writes points + # `_authToken` at that variable, so npm sends the placeholder as a real credential + # and never attempts the OIDC exchange. The registry masks the rejection as E404. + # With no credential configured, npm falls back to trusted publishing. - name: 🚀 Publish run: npm run publish:ci shell: bash + env: + NODE_AUTH_TOKEN: ''